On Apr 6, 2005 10:22 PM, Kimi Ostro <[EMAIL PROTECTED]> wrote: > Hello ! > > I am trying to understand how NAT affects packet filtering and am not > sure if I am on the right track. My understanding is this; > > $ext_if = "tun0" > $int_if = "fxp1" > > nat on $ext_if from $int_if:network port > 1023 to any -> ($ext_if) > > block all > > pass quick on lo0 > > pass in quick on $int_if > > # allow my caching/forwardind dns out > pass out on $ext_if inet proto tcp from $ext_if to any port 53 keep > state flags S/SA > > # allow http (port 80) out from internal network > pass out on $ext_if from $int_if:network to any port 80 keep state flags S/SA > > # eof > > from my understand is that DNS packets coming my firewall will pass > out creating a connection then create a state in pf's state table - > probably not evaluating the rule again, unless the packets destination > has changed? > > as for the second pass rule, I kinda expect it to pass any packets > destined to a port 80 (http in this case) on any host for the outside > world, translating the packets with a source IP of my internal network > to that of a IP of my external interfaces IP >
Your NAT rule nat on $ext_if from $int_if:network port > 1023 to any -> ($ext_if) only translates packets whose port is greater than 1023. 80 is not included hence. Why don't you add "keep state" to your rule pass in quick on $int_if also if you have not read http://www.openbsd.org/faq/pf/example1.html http://www.openbsd.org/faq/pf/ please go through it throughly :)) kind regards Siju
